loading
Loading content
loading
Recon
Pull acquired companies for a parent domain from SecurityTrails.
overview
get-acq takes a parent domain file (--domains) and a SecurityTrails API key (-a), calls the acquisitions endpoint, and returns acquired companies as JSON. That list often includes subsidiaries missing from the parent's own inventory.
Acquisitions widen scope before enumeration. A company bought last year still owns root domains, certificates, and services that may lag the parent's baseline. Listing them first keeps later discovery honest.
Run it early in recon, then hand acquired domains from the file and folder output into subdomain enumeration.
use cases
Point get-acq at a parent domain to pull the companies it has acquired, surfacing subsidiaries whose infrastructure rarely shows up in the parent's own asset inventory.
Run get-acq first to establish the real corporate boundary, then pass the acquired companies into subdomain discovery so nothing owned by the target gets skipped.
Recently acquired companies often lag behind the parent's security baseline. Listing them early points testing at the assets most likely to be under-monitored.
Schedule get-acq in a workflow so newly recorded acquisitions surface on their own, then chain the output into subfinder so each new company flows straight into enumeration.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domain-names | FILE | --domains | File with the list of parent domains to look up acquisitions for. |
| security-trails-apikey | STRING | -a | SecurityTrails API key used to authenticate the lookup. |
Showing key inputs. get-acq exposes 2 inputs in total.
example
# list the companies a target has acquired via SecurityTrailspython3 get-acq.py --domains domains.txt -a "$SECURITYTRAILS_API_KEY" -o acquisitions.json{ "endpoint": "/v1/domain/example.com/acquisitions", "acquisitions": [ "example.net", "example.org", "example.io", "example.dev", "example.app" ]}guidance
Use at the start of recon when you need the companies a target acquired before enumerating hostnames. Pair with amass-intel for root domains and subfinder for subdomains; this node only does the acquisition lookup.
Finds an organization's root domains and network ranges via ASN, CIDR, and reverse whois. Broader org discovery, no acquisition list.
Reverse WHOIS lookup. Finds domains registered to the same entity, a different relationship than corporate acquisitions.
Pulls WHOIS data through ripe.net. Useful for registration detail once you have the domains get-acq surfaces.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A file of parent domains feeds get-acq, which lists the companies the target acquired and hands them to subfinder for subdomain enumeration before they land as a queryable output.
Facts on this page come from the live Trickest tool library.